Critical severity · published Apr 27, 2026
CVE-2026-41409
Apache MINA: CWE-502 Deserialization of Untrusted Data
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed.
Affected versions are Apache MINA 2.0.0 <= 2.0.27, 2.1.0 <= 2.1.10, and 2.2.0 <= 2.2.5.
The problem is resolved in Apache MINA 2.0.28, 2.1.11, and 2.2.6 by
applying the classname allowlist earlier.
Affected are applications using Apache MINA that call IoBuffer.getObject().
Applications using Apache MINA are advised to upgrade
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
Apache MINA · Apache Software Foundation
2.2.0 through 2.2.5; 2.1.0 through 2.1.10; 2.0.0 through 2.0.27 · source: vendor
MI
Mina · Apache
2.0.0 before 2.0.28; 2.1.0 before 2.1.11; 2.2.0 before 2.2.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-41409
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-41409
Mailing List
https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9
More from Apache MINA
9.8
CVE-2026-94301
Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232
9.8
CVE-2026-47065
Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232
9.8
CVE-2026-42778
Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2)
9.8
CVE-2026-42779
Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)
9.8
CVE-2026-41635
Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE